Potential HIPAA Violation Costs Lab $16,500
- By Michelle Dick
- In Compliance
- January 27, 2023
- No Comments
Waiting too long to provide a medical record request may land you in hot water with the OCR.
Jan. 3 the full-service diagnostic laboratory, Life Hope Labs, LLC, settled on a potential HIPAA violation. The Office of Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) alleged the diagnostic laboratory in Sandy Springs, Georgia, was noncompliant because it did not allow access to medical records in a timely manner.
What Does OCR Consider Timely Access?
According to the OCR guidance on “Individuals’ Right Under HIPAA to Access their Health Information 45 CFR § 164.524,”
The Privacy Rule generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more ‘designated record sets’ maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice. Individuals have a right to access this PHI for as long as the information is maintained by a covered entity, or by a business associate on behalf of a covered entity, regardless of the date the information was created; whether the information is maintained in paper or electronic systems onsite, remotely, or is archived; or where the PHI originated (e.g., whether the covered entity, another provider, the patient, etc.).
Timeliness in providing PHI access means that “a covered entity must provide access to the PHI requested, in whole, or in part, … no later than 30 calendar days from receiving the individual’s request. See 45 CFR 164.524(b)(2). The 30 calendar days is an outer limit and covered entities are encouraged to respond as soon as possible,” OCR continues.
Failing to Comply with Timely Access Proves Costly
The complaint filed with the OCR on August 2021 alleged a personal representative asked Life Hope Labs for a copy of her deceased father’s medical records on July 7, 2021. She didn’t receive them until seven months later, on Feb. 12, 2022. “OCR’s investigation determined that Life Hope Labs’ failure to provide timely access to the requested medical records was a potential violation of the HIPAA right of access provision,” according to an HHS press release.
For the settlement, Life Hope Labs agreed to pay $16,500 to resolve the OCR investigation and to implement a corrective action plan with two years of OCR monitoring. You can find a copy of the Life Hopes Resolution Agreement and Correction Action Plan on the HHS website. This is the 43rd case to be investigated and resolved under OCR’s HIPAA Right of Access Initiative.
Sources
Individuals’ Right under HIPAA to Access their Health Information | HHS.gov
Life Hopes Resolution Agreement and Correction Action Plan | HHS.gov
- The Art of Negotiation Starts With an Action Plan - February 1, 2023
- Potential HIPAA Violation Costs Lab $16,500 - January 27, 2023
- OIG: Feds Lack Oversight of Telehealth Services - January 26, 2023
800-626-2633
Leave a Reply